Towline v0.5.0

Towline v0.5.0 adds the remote gateway: use your Towline projects as a connector in Claude, ChatGPT/Codex and other apps that have no terminal, from anywhere, without opening a port.

Remote gateway

export TUNNEL_TOKEN=<cloudflare tunnel token>
towline remote setup --url https://mcp.example.com --all

This deploys a towline-gateway stack through Portainer: the gateway plus cloudflared. The tunnel is outbound-only, so it works behind NAT, CGNAT or double NAT. Then:

1. Open https://mcp.example.com/ui and sign in with the owner token that setup printed.
2. Create a connection for the projects an app may use, with Read only or Deploy access.
3. Add https://mcp.example.com/mcp as a connector in the app.

Apps connect by signing in during a 10-minute window you open, with a client ID and secret, or with a header token (Claude Code, Cursor). Every change made through the gateway waits for your approval on the gateway page by default, on dev projects too. The gateway holds only each project's own team-scoped key, never the admin key.

Setup, Cloudflare settings and the security model: docs/remote-gateway.md. The gateway image is ghcr.io/changethisusername/towline-mcp:0.5.0.

New commands: towline remote setup | deploy | add | remove | status | owner-token.

Fixes for local projects

• Docker paths. A Docker API path with an unusual version prefix, such as /v1.43./containers/<id>/json, skipped the container ownership check in dockerProxy. Docker accepts any run of digits and dots as a version, and now so does the check.
• Streaming Docker reads are refused. dockerProxy refuses requests that never end: /events, attach, stats without stream=false, logs with follow, and container wait. Use towline_service_logs and towline_service_health instead.

Upgrading

towline update

Existing projects need no changes. To serve them remotely, run towline remote setup. Projects served remotely need a stack name of at most 24 characters.

Towline v0.4.1

Towline v0.4.1 fixes a v0.4.0 bug that left projects read-only: agents could read their stacks but every deploy failed with HTTP 403.

Action needed if you used v0.4.0

v0.4.0 gave project teams Portainer's Read-only user role instead of Standard user. This affects every project you ran towline refresh on with v0.4.0, and every project created with towline init on v0.4.0. Their agents get errors like:

failed to update local stack (HTTP 403): {"message":"Permission denied to access environment","details":"Authorization required for this operation"}

To fix them, update and refresh:

towline update
towline refresh --all

Each project should print Team role set to Standard user. To fix a project by hand instead: in Portainer, open Environments, choose the environment, open Manage access, and set the project's team (team-<project>-<tier>) to Standard user.

Fixes

• Team role. towline init and towline refresh look up the Standard user role by name from Portainer (/api/roles) instead of using a fixed ID, which was the Read-only user role. After setting it they read the role back from Portainer, print its name, and fail (init) or warn (refresh) if it isn't Standard user. They also warn when the team's role can't update stacks. towline refresh --keep-role now reports the current role instead of saying nothing.
• .gitignore. Towline now ignores only the files that hold the project token (.mcp.json, .cursor/mcp.json, .gemini/settings.json, towline.json) instead of the whole .claude/, .cursor/ and .gemini/ directories, which many repositories track. towline refresh replaces the directory lines v0.4.0 appended under its "Towline agent configuration" comment; lines you wrote yourself are left alone.
• Tracked-secrets warning. towline refresh no longer warns that .claude/settings.json holds the project token (it doesn't), and towline init no longer refuses to run in a repository that tracks .claude/.

Towline v0.4.0

Towline v0.4.0 is a security and reliability release. It includes everything planned for v0.3.0, which was never published, plus the fixes from a full review of the codebase.

Upgrading

towline update
towline refresh --all

Then restart your agent sessions. towline refresh carries existing projects over: it keeps your other MCP servers and flags, and it adds the bind mounts, external networks and named volumes your deployed stacks already use to each project's allow-lists, so they keep deploying under the stricter compose policy.

Behavior changes to know about

• Compose files that join an external network or use an external or explicitly named volume must now be allow-listed in towline.json under compose_policy.allow_networks / allow_volumes. towline refresh does this for what's already deployed.
• CLI flags must come before the project name (towline init --tier prod shop). Flags placed after it used to be ignored silently; they're now an error.
• towline destroy exits non-zero if any Portainer resource was left behind.
• towline_scale accepts whole numbers from 0 to 20.

Approvals

• New built-in approval server: towline approvals setup | serve | list | show | approve | reject, with a web UI and optional ntfy notifications. Prod operations can be approved by a human (human mode) or confirmed by the agent itself (agent mode).
• An approval for one operation can no longer be used to run a different one. Previously, after an approval server restart an agent could get a harmless-looking request approved under its token. Request IDs are now secret and separate from the agent's token.
• Approval tokens are claimed atomically, so concurrent re-calls run an approved operation once.
• The approver always sees the full arguments; oversized ones are refused instead of truncated.
• Pending requests are capped, ntfy pushes no longer include tool arguments, and UI login works behind a reverse proxy (--public-url).

Compose security policy

• Rejected: external or named volumes and external, named or custom-driver networks unless allow-listed; network_mode other than bridge/none; multi-document compose files; privileged post_start/pre_stop hooks; non-GPU device reservations.
• Names under .towline are reserved for Caddy routing, so one stack can't receive another stack's routed traffic.

CLI

• towline refresh upgrades existing projects in place and no longer trusts agent-editable IDs in towline.json with the admin key.
• towline init in an existing repository merges into your existing .mcp.json and agent settings instead of overwriting them, and refuses to run over an existing project or over token files already tracked by git.
• Portainer requests and self-update downloads have timeouts; --help exits cleanly.

MCP tools

• Docker-backed tools (health, logs, exec, dockerProxy) now work against an http:// Portainer, and Docker API errors are reported as errors.
• Parallel tool calls no longer lose each other's changes.
• Logs from TTY containers are no longer mangled, and since accepts RFC3339 timestamps, durations like 10m, or unix seconds.
• towline_exec gives up after 30 seconds and returns the output so far.
• Traefik domain edits keep existing labels intact; Caddy routes dial a stack-unique alias.
• towline_env_set validates variable names.

Full list of changes: v0.2.0...v0.4.0

Towline v0.2.0

Changelog

• 7bb4476 feat: add towline update command for self-updating from GitHub Releases
• 658c5db fix: use RoleId 1 (environment administrator) for team access

Towline v0.1.0

Changelog

• 59502f4 Add Towline design specification and initial CLAUDE.md
• b0e24ab Add implementation plan Chunks 4-6: proxy/scale/exec, CLI, templates/skill
• a74f1ae Add implementation plan: Chunks 1-3 with review fixes applied
• b6670ec Address spec review: fix 12 issues found by reviewer
• 9516504 Fix remaining review issues: stdin conflict, JWT user ID, stack ID in destroy, unused import
• db28338 Fix remaining spec review items: deployment storage reference, semver note, tooldef tree
• b8af001 Fix review issues in Chunks 4-6: embed.FS paths, variable shadowing, exec Body type, Caddy dial parsing
• dd6f849 Merge branch 'worktree-agent-a3391ac1'
• 7a11796 Merge branch 'worktree-agent-a3d7f309'
• 7647a0f feat: add 9 compose templates (api, fullstack, worker, static-site, mysql, mongo, n8n, wordpress, ghost)
• 37a2126 feat: add installer script, GoReleaser config, CI/release workflows
• b48c0b8 feat: add production DevOps skill
• 4e28b04 feat: add server accessor methods for middleware support
• c55c011 feat: add service name resolution utility
• ad90e70 feat: add skeleton packages for middleware, approval, towline handlers, proxy, config, and CLI
• 1c37167 feat: add template pack system with skills + MCP configs, curate templates
• b3e6340 feat: add towline help command and post-install guidance on website
• d98926c feat: add towline tool definitions YAML and embed support
• e4560e3 feat: add towline.dev website with landing page, agent docs, and install endpoint
• 7f24ed9 feat: auto-detect existing codebase — no --dir flag needed
• 63706eb feat: implement CLI stubs for promote, rotate-keys, status
• 4aabcae feat: implement Caddy proxy backend
• 81f0b5a feat: implement Cloudflare tunnel delegation
• 2a5ec4a feat: implement Portainer API client for CLI
• d8ac2fb feat: implement Traefik proxy backend
• d49df13 feat: implement config loading and saving
• 013a20a feat: implement container ownership middleware for Docker proxy
• afe0782 feat: implement stack scoping middleware
• 1c7fa54 feat: implement template system with embed.FS
• 681f404 feat: implement tier gating middleware with in-chat approval flow
• c31c657 feat: implement towline destroy command
• f08bb41 feat: implement towline init command
• f187747 feat: implement towline list command
• 94c61d4 feat: implement towline setup command
• cac2880 feat: implement towline_deployments handler
• 61a2615 feat: implement towline_domains handlers
• d320f31 feat: implement towline_env_get and towline_env_set handlers
• d457dbf feat: implement towline_exec handler
• 2d67caa feat: implement towline_scale handler
• 39b6cf9 feat: implement towline_service_health handler
• bb9f636 feat: implement towline_service_logs handler
• 760378d feat: initialize towline repo with upstream Portainer MCP v0.7.0 fork
• a685d8f feat: register all towline tools in MCP entry point
• 06e4aba feat: support existing codebases with towline init --dir
• 501cd91 feat: wire middleware into towline-mcp entry point
• 7070dc8 fix: 7 bugs found by full codebase audit
• dcf42b6 fix: accurately describe all Towline components including skills and packs
• da9631e fix: authenticate as project user before generating their API token
• a7f92ad fix: harden upstream Portainer MCP integration — 13 issues fixed
• d6a78fa fix: pass password to Portainer API token generation endpoint
• 10b3592 fix: simplify create project step, don't imply templates are required
• eb24f52 fix: use .mcp.json for MCP server config (Claude Code ignores mcpServers in .claude/settings.json)
• 13bd2fe refactor: rebuild landing page — informational, light, minimal